CyberSecBulletin

Rabithua vulnerabilities

We track 2 vulnerabilities in Rabithua products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.

2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score

Latest Rabithua vulnerabilities

  • 7.2 High severity

    Rote: Improper Privilege Management

    CVE-2026-126803Rabithua

    Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the secu

  • 8.8 High severity

    Rote: Authorization Bypass Through User-Controlled Key

    CVE-2026-126801Rabithua

    Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over no